CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 17:32 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-100298 | YS YSSD-RTMP-H5 Anjvision | 8.8 | Sep 29 | Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5 |
| CVE-2026-100296 | YS YSSD-RTMP-H5 Anjvision | 8.1 | Sep 29 | Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5 |
| CVE-2026-102327 | CH Chrome Google | 7.5 | Sep 29 | Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute… |
| CVE-2026-102321 | CH Chrome Google | 8.8 | Sep 29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102302 | CH Chrome Google | 8.8 | Sep 29 | Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102324 | CH Chrome Google | 8.3 | Sep 29 | Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code… |
| CVE-2026-102301 | CH Chrome Google | 8.3 | Sep 29 | Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside… |
| CVE-2026-102328 | CH Chrome Google | 8.8 | Sep 29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102326 | CH Chrome Google | 8.8 | Sep 29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102323 | CH Chrome Google | 8.8 | Sep 29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102299 | CH Chrome Google | 8.8 | Sep 29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-102317 | CH Chrome Google | 8.6 | Sep 29 | Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outside the sandbox via… |
| CVE-2026-100294 | YS YSSD-RTMP-H5 Anjvision | 7.5 | Sep 29 | Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5 |
| CVE-2026-100293 | YS YSSD-RTMP-H5 Anjvision | 8.8 | Sep 29 | Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5 |
| CVE-2026-100292 | YS YSSD-RTMP-H5 Anjvision | 8.8 | Sep 29 | Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5 |
| CVE-2026-96274 | N4 Nova 430H eNodeB (model pBS3101SH) Baicells | 7.4 | Sep 29 | Uncaught exception in Baicells Nova 430H |
| CVE-2026-76728 | IO Instant ON Hewlett Packard Enterprise (HPE) | 7.2 | Sep 29 | Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs |
| CVE-2026-76727 | IO Instant ON Hewlett Packard Enterprise (HPE) | 7.2 | Sep 29 | Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON |
| CVE-2026-76726 | IO Instant ON Hewlett Packard Enterprise (HPE) | 8.1 | Sep 29 | Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint |
| CVE-2026-61519 | LC Liberu CRM Liberu Software | 8.8 | Sep 29 | Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember() |
| CVE-2026-102831 | JU jupyterlab jupyterlab | 8.1 | Sep 29 | JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard |
| CVE-2026-102616 | WO WorkFlow-Engine risesoft-y9 | 7.3 | Sep 29 | risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection |
| CVE-2026-102826 | GI git-js steveukx | 8.1 | Sep 29 | simple-git allows command execution through unblocked Git configuration includes |
| CVE-2026-102823 | RU russh Eugeny | 7.5 | Sep 29 | russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened |
| CVE-2026-84414 | I i IBM | 7.8 | Sep 29 | IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service [] |
| CVE-2026-102730 | ED eclipse-threadx/levelx(NAND driver) Eclipse Foundation | 8.6 | Sep 29 | Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata… |
| CVE-2026-84421 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 29 | DataStage on Cloud Pak for Data has several vulnerabilities |
| CVE-2026-84422 | GD Guardium Data Protection IBM | 7.2 | Sep 29 | IBM Guardium Data Protection is affected by multiple vulnerabilities. |
| CVE-2026-102728 | ND NetX Duo Eclipse Foundation | 7.5 | Sep 29 | Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them |
| CVE-2026-84440 | GD Guardium Data Protection IBM | 8.8 | Sep 29 | IBM Guardium Data Protection is affected by multiple vulnerabilities. |
| CVE-2026-84842 | GD Guardium Data Protection IBM | 8.1 | Sep 29 | IBM Guardium Data Protection is affected by multiple vulnerabilities. |
| CVE-2026-102242 | MT MCP Toolbox for Databases Google | 8.6 | Sep 29 | Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases |
| CVE-2026-102718 | ND NetX Duo Eclipse Foundation | 8.7 | Sep 29 | hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte… |
| CVE-2026-102716 | EC eclipse-threadx/netxduo Eclipse Foundation | 8.7 | Sep 29 | An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert |
| CVE-2026-102677 | EL electron electron | 8.8 | Sep 29 | Electron: Sandboxed preload code cache can be poisoned by a compromised renderer |
| CVE-2026-102715 | EC eclipse-threadx/netxduo Eclipse Foundation | 7.1 | Sep 29 | mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet |